ISIS Secret Cyber Terrorism Forum Exposed

The forum reflects ISIS hackers' growing desire to wage war online

Hundreds of Islamic State supporters have flocked to an online channel dedicated to providing tools needed to wage campaigns of cyber terror across the Internet.

More than 300 people now belong to an IS-affiliated forum filled with users swapping material on how to target and hack into vulnerable networks and computer systems. Deep Web research firm Vocativ discovered the jihadi e-academy on Telegram, a social messaging app that ISIS supporters have used previously to share instructions on how to make explosive devices, hand grenades, suicide belts and Molotov cocktails.

“This channel is dedicated to publishing courses of hacking and programming languages for the supporters of the Caliphate on the Internet,” reads the forum, which was formed on Nov. 24—less than two weeks after ISIS militants waged an orchestrated massacre in the streets of Paris.

Cyber security experts who reviewed some of the hacker material shared on Telegram said that it doesn’t provide the type of know-how required to carry out the kind of catastrophic cyber attack that many of these experts say is possible. The experts also conceded, however, that it reflects the group’s budding desire to wage increasingly sophisticated warfare online.

“Can they do damage? Sure,” said Herb Lin, a Senior Research Scholar for Cyber Policy and Security at Stanford University. “Can they do the kind of damage that causes all of the lights to go out in New York City? That’s much more difficult to discern.”

The bulk of material published on the ISIS hacker forum consisted of videos and content offered for free elsewhere online. Users, for example, recently shared a free, 27-part course on penetration testing, a practice that involves testing a computer system or network for vulnerabilities that a hacker can exploit.

Nearly all of the tutorials reviewed by Vocativ focused on similar skill sets. Experts said they alone are not enough to do serious damage. “Once you get inside a system you need to know what to do,” said Lars Hilse, a digital strategy consultant who authored a report on cyber terrorism last year. “That requires a certain degree of cleverness that, by itself, presents a hurdle to most people.”

The track record among hackers who claim to be affiliated with ISIS has not displayed that level of proficiency. ISIS supporters failed to follow through on threats they made to infiltrate US security on the anniversary of 9/11 this year and an attempt this month to dox US Senate Minority Leader Harry Reid relied on publicly available information, much of which was outdated or inaccurate, Vocativ found.
    
One of the more celebrated cyber attacks claimed by ISIS came in January when members of its so-called “Cyber Caliphate” managed to hack into US Central Command’s Twitter account. No actual Pentagon network or internal system was breached.

Such achievements are a far cry from any ability to cripple entire financial, military and communication systems, which analysts claim is feasible. And they pale in comparison to some of the recent cyber attacks conducted against the US by hackers based in China and Iran, who have managed to breach government data and gain access to American utility networks.

Yet to dismiss the desire among ISIS supporters to commit “cyber jihad” would be wrongheaded, said Alan Brill, a senior managing director at Kroll, a security consulting firm. Brill and other experts have warned for years that networks containing access to critical information and infrastructure are vulnerable. With a group as well-funded, well-organized and as committed to terror as ISIS on the scene, that’s enough to sound the alarm bells.

“If you just think about the interplay of rising hacker skills on the part of terrorists like ISIS and poor security it leads to the conclusion that there’s a significant amount of risk,” Brill told Vocativ. “To be honest, it scares me.”

Hilse said his own fears were realized in April when a group of hackers brought down a television network in France and infiltrated its website and Facebook page. The hackers claimed allegiance to the Islamic State. If it is proven that ISIS was behind the attack, it would signify a new level of sophistication for the terror group, albeit one that it has not demonstrated since.

“It would mean that ISIS is capable of breaching the cyber-physical threshold and actually getting into the real world,” Hilse said. While he’s cautious about giving credit to ISIS, it still remains a wakeup call.
“I know what the possibilities are if the dots are connected,” he said. “The damage can be potentially dire to our Western way of life.”

Vocativ: http://voc.tv/1VB6ilh